Load balancer support

The AVEVA Web Client supports the use of a load balancer. The purpose of the load balancer is to:

• Provide a single controlled ingress point for all end-user web traffic across multiple customer networks.

• Improve system security by exposing only the Load Balancer FQDN to end users, thus avoiding exposure of internal IPs and system details.

• Block all direct access to backend machines and services.

Architecture

• Web Client, proxies, and related services are placed behind the load balancer.

• Backend systems are accessible only within the internal network.

• Cross-network and external access is permitted only through the Load Balancer.

This approach supports environments with:

• Multiple network zones.

• Strict segregation between secure and less secure networks.

Requirements

• System Platform 2026 onwards for InTouch Web Client.

• AVEVA Platform Common Services (PCS) version 8.2 or higher installed on the System Management Server (SMS) node. PCS 8.2.1 is included with System Platform 2023 R2 SP1 P04.

Configuration

To enable load balancing, you must create a json file called userappsettings.json on the SMS node at the following location:
<Root Drive>:\Program Files (x86)\AVEVA\Platform Common Services\Management Server

1. Check that PCS 8.2 or higher version is deployed on the SMS server node. This patch will install PCS 8.2.1.

2. Add the following content to the json file:

   {

   "ForwardedHeaders": {

   "Enabled": true

   }

   }

   <Root Drive>:\Program Files (x86)\AVEVA\Platform Common Services\Management Server

3. On the SMS node, restart the AVEVA Identity Manager service from Services.msc.

4. On the Web Client node(s), undeploy the ViewEngine (for InTouch Web Client).

5. In the usersettings.json file located at the path below, update the value of Enabled to true:

   <Root Drive>:\Program Files (x86)\Common Files\ArchestrA\Services\proxyserver

6. Redeploy the WebViewEngine or ViewEngine.

7. Open the Configurator on the following nodes and make sure the load balancer FQDN is configured in the AVEVA Identity Manager Registration:

   • SMS node

   • IDE node

   • Web Client node(s)

8. CONNECT: If you are using CONNECT, make sure that the load balancer URL is registered as an allowed callback URL in CONNECT.

Limitations

Historization controls, specifically the TrendPen and TrendApp, are not currently compatible with a load balancer–based access model. When these controls are routed through the load balancer, functional failures may occur due to application design assumptions that conflict with standard load balancing behaviour. Work to mitigate this behavior is in progress and is planned for the next release.